Authenticated arbitrary file read via absolute path traversal

Absolute path traversal in Dell Wyse Management Suite before 3.3 allows remote authenticated users to read arbitrary server files via the web interface. The /ccm-web/image/os endpoint concatenates attacker-supplied filePath and fileName values without constraining them to an intended directory, enabling retrieval of files such as database contents and credentials. Access requires a valid Wyse device ID, which NCC Group showed can be obtained by a man-in-the-middle attacker on a thin client connection; disclosed impact is arbitrary file disclosure that can expose administrative session data.